GM settles with 36 states for $220 million over sale of driver data

What happened and what to do

According to the report by The Record, General Motors agreed to pay $220 million to end a lawsuit brought by attorneys general from 36 states. The complaint alleges the company illegally sold information about driver behavior to third parties. The settlement also includes reforms to how this data is handled.

For companies that collect data from connected vehicles, apps or devices, the case shows the risk of usage data being reused without a clear purpose and consent. A practical response starts with an inventory of which signals are captured, for what purpose and who receives them. A pipeline can then tag each field with its legal basis and purpose, block sensitive data from reaching unauthorized partners and record every transfer in an audit trail. A governance dashboard can show, in real time, which sharing contracts are active and which users have opted out.

How the consultancy can help

Assessment of exposure to telemetry and user behavior data, with mapping of internal and third-party data flows, review of consent and contracts, and design of technical controls such as purpose tagging, sharing blocks and audit trails, implemented on the client's infrastructure.

Next step

If your company collects or shares data from vehicles, devices or user behavior, send us a short description of your case and receive a scoped proposal for assessment and implementation.